Alexander Heldt
cffaec5fe8
Wire the offline-first todo app (github: local /home/alex/code/todo) into manatee, following the app-module convention: - flake input `todo` (local git checkout for now; gitea URL commented) with nixpkgs following. - hosts/manatee/modules/todo: mod.todo option importing the app's NixOS module; runs on 127.0.0.1:8091, secureCookies, token from agenix; the host owns the nginx vhost (todo.ppp.pm, forceSSL + useACMEHost) and homepage card. - mod.todo.enable = true. - certs: todo.ppp.pm DNS-01 cert via hetzner. - home-assistant DNS updater: add `todo` to the Hetzner subdomain list. - secrets: todo-token.age (encrypted access token) + recipients in secrets.nix.
59 lines
1.3 KiB
Nix
59 lines
1.3 KiB
Nix
{
|
|
inputs,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
enabled = config.mod.todo.enable;
|
|
nginxEnabled = config.mod.nginx.enable;
|
|
port = 8091;
|
|
in
|
|
{
|
|
options = {
|
|
mod.todo = {
|
|
enable = lib.mkEnableOption "Enable todo module";
|
|
};
|
|
};
|
|
|
|
imports = [
|
|
inputs.todo.nixosModules.default
|
|
];
|
|
|
|
config = lib.mkIf enabled {
|
|
mod.homepage.services = [
|
|
{
|
|
name = "Todo";
|
|
port = port;
|
|
description = "Offline-first todo";
|
|
# Login needs HTTPS (Secure cookies), so link to the public vhost.
|
|
url = "https://todo.ppp.pm";
|
|
}
|
|
];
|
|
|
|
services.todo = {
|
|
enable = true;
|
|
address = "127.0.0.1";
|
|
inherit port;
|
|
# Served publicly over HTTPS via the nginx vhost below.
|
|
secureCookies = true;
|
|
tokenFile = config.age.secrets."todo-token".path;
|
|
# sessionSecretFile is left unset: the app generates one in its state dir
|
|
# (/var/lib/todo) on first boot, mode 0600.
|
|
};
|
|
|
|
services.nginx = lib.mkIf nginxEnabled {
|
|
virtualHosts."todo.ppp.pm" = {
|
|
forceSSL = true;
|
|
useACMEHost = "todo.ppp.pm";
|
|
|
|
locations."/" = {
|
|
proxyPass = "http://127.0.0.1:${toString port}";
|
|
};
|
|
};
|
|
};
|
|
|
|
age.secrets."todo-token".file = ../../../../secrets/manatee/todo-token.age;
|
|
};
|
|
}
|